EUVD-2026-27337
GHSA-489r-v3h6-c72q
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
The traceroute diagnostic handler in /bin/httpd_clientside for ALTICE LABS / SFR France GR140DG and GR140IG fibre CPE/Router/Gateway, inserts unsanitized user input into a system() call, allowing authenticated remote attackers to execute arbitrary commands as root via crafted destAddr parameters using shell command substitution.
AnalysisAI
Authenticated command injection in ALTICE LABS GR140DG and GR140IG fiber gateways allows remote attackers with valid credentials to execute arbitrary commands as root through the traceroute diagnostic handler. The vulnerability exists in the /bin/httpd_clientside component where unsanitized destAddr parameters are passed directly to system() calls, enabling shell command substitution attacks. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all ALTICE LABS GR140DG and GR140IG devices in production and identify which are accessible to untrusted networks. Within 7 days: Implement access controls restricting administrative credentials to ISP-authorized personnel only and disable remote diagnostic features if operationally feasible; escalate to ALTICE LABS for patch timeline and interim guidance. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today